The vulnerability in TeamDavid's Webbox application involves improper validation of the 'cType' URL parameter, which allows injection of control characters such as URL-encoded newlines (%0a) or colons. This enables attackers to inject additional HTTP headers, including extra Location headers, resulting in an open redirect (CWE-601). The vulnerability affects versions prior to Rollout 528, after which the functionality is disabled by default, removing exposure to this issue.

An attacker can exploit this vulnerability to perform open redirect attacks by injecting additional Location headers via the 'cType' parameter. This can redirect users to untrusted sites, potentially facilitating phishing or other malicious activities. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and low impact on confidentiality, integrity, and availability.

Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, effectively mitigating the issue. Users should upgrade to Rollout 528 or later to ensure this vulnerability is not exposed. No additional patches or fixes are explicitly stated; disabling the affected functionality is the recommended remediation.